First, you will need to setup the security groups for the Sage 300 user. You will need to give the Sage 300 user access to the 'Sage 300 Web API' option under Security Groups (per each module required).

A minor gotch-ya with using the new REST api is that the ADMIN account doesn't have access to the API. If you want the ADMIN to have access, you will need to edit both 'web.config' files in the \Online\Web and \Online\WebApi folder; change the key 'AllowWebApiAccessForAdmin' to true. Restart the webAPI app-pool for the settings to take.

Once the user access is done, the next step would be to see if they can access the webapi from http(s)://server/sage300webapi/

From there, check if they can access the swaggerUI (it's a link on that webapi page). Here they will be able to view all endpoints and even test out functions (like reading all vendors). Swagger is the API documentation that your external company can use for reference.

Also, we Open Source our Web SDK. In the 'samples' folder, you will find several samples and tutorials that illustrate how to drive the Web API via code and is a great way to learn about the Web API.